The Agent Skills Directory

[SAFE]: The skill provides instructional content and code templates for official and well-known libraries (next-cloudinary and the Cloudinary Node.js SDK).
[DATA_EXPOSURE_PREVENTION]: Multiple files (SKILL.md, references/environment.md, references/signed-uploads.md) contain explicit security rules and warnings to prevent the exposure of the CLOUDINARY_API_SECRET. It specifically instructs developers never to use the NEXT_PUBLIC_ prefix for secrets, which is a standard security best practice in the Next.js ecosystem.
[COMMAND_EXECUTION]: The provided assets (assets/server-action-upload.ts, assets/server-action-delete.ts) use the official cloudinary SDK to perform asset management. These operations are restricted to server-side contexts ("use server") as required for security.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (public IDs and file uploads).
Ingestion points: Public IDs are ingested via the src prop in CldImage and helpers; files are ingested via FormData in server actions.
Boundary markers: The skill defines a strict core workflow in SKILL.md to classify user goals before generating code.
Capability inventory: Capabilities are limited to Cloudinary asset management (upload, delete, transform) via the official SDK.
Sanitization: The instructions provide TypeScript patterns for narrowing and validating upload results in references/typescript.md and enforce specific public ID formats.

cloudinary-next